1
Risk Optimization
hard
A pension fund administrator has completed a quantitative risk analysis for its core benefits-processing platform. The analysis shows an inherent annualized loss expectancy of $4.8 million. Management has implemented redundant data centers, automated reconciliation controls, and 24x7 monitoring at an annual cost of $900,000, which reduces the expected loss to $1.1 million. The CIO argues the remaining $1.1 million should be treated as fully mitigated because controls are now in place. As the CGEIT practitioner advising the risk committee, what is the MOST appropriate governance response?